uTox vulnerabilities

CVEs whose affected-version data names the uTox package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113352High· 7.5

yesterday

uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant …

▾ TwilightuTox · uToxvia CVEORG